52 matches found
CVE-2024-13942
Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...
CVE-2024-13942
The RK3588s BootROM (secure) version 350B20210512V100 reads the next-stage loader header twice: a partial read (module hashes only) and a full read (with signature). Module authenticity is checked against the partial data, enabling a TOCTOU attack where an attacker swaps in a modified header on-t...
EUVD-2024-55729
Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...
CVE-2024-13942 Rockchip RK3588s Secure BootROM TOCTOU (time-of-check to time-of-use) vulnerability leading to arbitrary code execution with highest privileges
Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...
CVE-2024-13942: Time-of-check Time-of-use (TOCTOU) Race Condition
Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media SPI NOR or NAND, EMMC or SD. The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key,...
PT-2026-78520
Name of the Vulnerable Software and Affected Versions RK3588s SoC BootROM secure version 350B20210512V100 Description The Secure BootROM of the RK3588s SoC is susceptible to a time-of-check to time-of-use TOCTOU attack when booting from external media such as SPI NOR, NAND, EMMC, or SD. The issue...
pwnage24mtk — Updated!
pwnage24mtk Cert exploit for MTK devices.There is a logic flaw in MTK cert verification process.Similar to CVE-2023-20696. Patched. CVE-2023-20696 CVE-2025-20730 There are some issues about architecture detect.Need to be fixed when I am free.Or anyone can make a pull request. This is a vibe-coded...
EUVD-2017-9431
Malware in sbrugna...
Sonos Speaker Flaws Could Have Let Remote Hackers Eavesdrop on Users
Cybersecurity researchers have uncovered weaknesses in Sonos smart speakers that could be exploited by malicious actors to clandestinely eavesdrop on users. The vulnerabilities "led to an entire break in the security of Sonos's secure boot process across a wide range of devices and remotely being...
Out-of-bounds
Trusted Firmware-A TF-A before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is not validated well enough in the function sdeiinterruptbind. The parameter is passed to a call to platicgetinterrupttype. It can be any arbitrary value passing...
CVE-2023-49100: Out-of-bounds Read
Trusted Firmware-A TF-A before 2.10 has a potential read out-of-bounds in the SDEI service. The input parameter passed in register x1 is not validated well enough in the function sdeiinterruptbind. The parameter is passed to a call to platicgetinterrupttype. It can be any arbitrary value passing...
Improper access control
HLOS to access EL3 stack canary by just mapping imem region due to Improper access control and can lead to information exposure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice ...
CVE-2020-11199
HLOS to access EL3 stack canary by just mapping imem region due to Improper access control and can lead to information exposure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice ...
CVE-2020-11199
CVE-2020-11199 is linked to Qualcomm’s HLOS component and involves an information-disclosure vulnerability caused by improper access control. The issue allows a local attacker to access the EL3 stack canary by simply mapping the imem region, leading to exposure of sensitive information across mul...
CVE-2020-11199: Exposure of Sensitive Information to an Unauthorized Actor
HLOS to access EL3 stack canary by just mapping imem region due to Improper access control and can lead to information exposure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice ...
PT-2021-9224
Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon affected versions not specified Description The issue is related to improper access control, allowing HLOS to access the EL3 stack canary by mapping the imem region. This can lead to information exposure in various Snapdrag...
Exploit for Out-of-bounds Write in Google Android
CVE-2020-12753-PoC This repo contains a proof-of-concept for 🔋...
CVE-2020-12753
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Arbitrary code execution can occur via the bootloader because of an EL1/EL3 coldboot vulnerability involving rawresources. The LG ID is LVE-SMP-200006 May 2020...
CVE-2020-12753
An issue was discovered on LG mobile devices with Android OS 7.2, 8.0, 8.1, 9, and 10 software. Arbitrary code execution can occur via the bootloader because of an EL1/EL3 coldboot vulnerability involving rawresources. The LG ID is LVE-SMP-200006 May 2020...
PT-2020-13244
Name of the Vulnerable Software and Affected Versions LG mobile devices with Android OS versions 7.2, 8.0, 8.1, 9, and 10 Description An issue was discovered that allows arbitrary code execution via the bootloader due to an EL1/EL3 coldboot vulnerability involving raw resources. This vulnerabilit...